IndicatorPublished 17 Jan 2026Updated 18 Jan 2026

ThreatFox IOCs for 2026-01-17

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 203

get-comp.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
leshanapas-64300.portmap.hostAsyncRAT botnet C2 domain (confidence level: 100%)
www.windows-updates.usCobalt Strike botnet C2 domain (confidence level: 75%)
looppli.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
civiliq.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
directi.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
network000.ddns.netXWorm botnet C2 domain (confidence level: 100%)
hulk88-35315.portmap.hostAsyncRAT botnet C2 domain (confidence level: 100%)
popapopa-41352.portmap.hostQuasar RAT botnet C2 domain (confidence level: 100%)
chirtyfivev.crabdance.comAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 23

https://app.quietnetpro.com/browser/chrome?uuid=nullUnknown malware payload delivery URL (confidence level: 90%)
https://app.getauroravpn.com/browser/chrome?uuid=nullUnknown malware payload delivery URL (confidence level: 90%)
https://chromium.report.tech.b21822va-72if4-j3ar-k4618.verifycores.com/browser/chrome?uuid=56cd5f6f-5d05-42b5-8e08-07da3c51b1c3%20=!=Unknown malware payload delivery URL (confidence level: 90%)
https://gogisich.com/browser/chrome?uuid=nullUnknown malware payload delivery URL (confidence level: 90%)
https://forreststonesolutions.com/robots/Unknown malware payload delivery URL (confidence level: 90%)
https://strategicshift.au/robots/Unknown malware payload delivery URL (confidence level: 90%)
https://habibitravel.co.id/captha/Unknown malware payload delivery URL (confidence level: 90%)
https://cdn.jsdelivr.net/gh/escalator82-12-facecloth-junkyard/worldstate-27-delta-vsync/shard-managerClearFake payload delivery URL (confidence level: 100%)
http://116.62.129.19:65510/doiaCobalt Strike botnet C2 (confidence level: 75%)
https://chromium.report.tech.b55081fa-9cd1-48c2-95d4-efe.crashnotify.org/browser/chrome?uuid=nullUnknown malware payload delivery URL (confidence level: 90%)

IP addresses 118

91.92.243.147Stealc botnet C2 server (confidence level: 100%)
208.87.205.39Unknown malware botnet C2 server (confidence level: 75%)
179.61.197.40Unknown malware botnet C2 server (confidence level: 75%)
156.241.125.238Unknown malware botnet C2 server (confidence level: 75%)
130.12.182.167Remcos botnet C2 server (confidence level: 100%)
154.22.5.248Remcos botnet C2 server (confidence level: 100%)
18.212.248.165Meterpreter botnet C2 server (confidence level: 100%)
150.241.230.84Mirai botnet C2 server (confidence level: 80%)
195.24.236.7Remcos botnet C2 server (confidence level: 100%)
128.90.106.221AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-17

Impact

For European organizations, the primary impact of this threat lies in the potential for malware payload delivery via network vectors, which could lead to unauthorized access, data exfiltration, or disruption of services. While no active exploits are reported, the presence of IOCs enables attackers to attempt infiltration through known or emerging malware campaigns. Organizations relying heavily on OSINT and threat intelligence platforms may be targeted or affected by related network activity. The medium severity suggests moderate risk, with potential impacts on confidentiality and availability if payload delivery succeeds. Disruption could affect critical infrastructure, financial institutions, or government entities, especially those with extensive network exposure. The lack of patches means organizations must rely on detection and prevention controls rather than remediation. Overall, the threat could contribute to increased incident response workloads and necessitate enhanced monitoring to prevent escalation.

Defensive guidance

European organizations should implement advanced network monitoring solutions capable of detecting suspicious payload delivery patterns and known IOCs from the ThreatFox feed. Integration of this threat intelligence into Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems will improve detection accuracy. Regularly updating firewall and intrusion detection/prevention system (IDS/IPS) signatures with the latest IOCs is critical. Conducting phishing awareness training and enforcing strict email filtering can reduce the risk of initial infection vectors. Network segmentation and least privilege access policies will limit lateral movement if payload delivery is successful. Organizations should also participate in information sharing communities to stay informed about evolving threats. Since no patches are available, proactive detection and rapid incident response are essential. Finally, conducting regular threat hunting exercises focusing on network activity and payload delivery indicators will help identify early compromise signs.

Community reviews

Loading reviews…